Lockfiles
Lockfiles exist so dependency resolution becomes a recorded fact rather than a fresh surprise on every machine.
What they buy you
Section titled “What they buy you”- repeatable builds
- reviewable dependency movement
- less ambient uncertainty about what the package graph actually is
How to think about them
Section titled “How to think about them”The manifest says what the package wants.
The lockfile says what Riot actually selected for this workspace state.
That distinction is what keeps package work understandable once the graph gets nontrivial.